Merge remote-tracking branch 'cd/master'

10 files changed, 68 insertions, 431 deletions

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 1122e6a19..10c87b2c6 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -14,11 +14,9 @@ with lib;
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/cd";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
@@ -26,7 +24,6 @@ with lib;
   imports = [
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
     #../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
@@ -118,7 +115,6 @@ with lib;
     iftop
     iotop
     iptables
-    mutt    # for mv
     nethogs
     ntp     # ntpate
     rxvt_unicode.terminfo
@@ -129,17 +125,4 @@ with lib;
     SystemMaxUse=1G
     RuntimeMaxUse=128M
   '';
-
-  users.extraUsers = {
-    mv = {
-      uid = 1338;
-      group = "users";
-      home = "/home/mv";
-      createHome = true;
-      useDefaultShell = true;
-      openssh.authorizedKeys.keys = [
-        config.krebs.users.mv.pubkey
-      ];
-    };
-  };
 }
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index e8e354197..6ae4f80e8 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -17,29 +17,12 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.mkdir;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@${primary-addr4}";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/secrets/mkdir";
-    };
-    dir.stockholm = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
     ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index df45b8177..0c6c935a3 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -4,28 +4,11 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.nomic;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@nomic.gg23";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/secrets/nomic";
-    };
-    dir.stockholm = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/AO753.nix
-    ../2configs/base.nix
     #../2configs/consul-server.nix
     ../2configs/git.nix
     {
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index e24ef64fc..1f1d975c9 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -17,29 +17,12 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.rmdir;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@rmdir.internet";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/secrets/rmdir";
-    };
-    dir.stockholm = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
     ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 85fba1d8a..3fa5481e2 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -4,28 +4,9 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.wu;
-  krebs.build.user = config.krebs.users.tv;
-
-  krebs.build.target = "root@wu";
-
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/secrets/wu";
-    };
-    dir.stockholm = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/stockholm";
-    };
-  };
 
   imports = [
     ../2configs/hw/w110er.nix
-    ../2configs/base.nix
     #../2configs/consul-client.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
@@ -62,31 +43,24 @@ with lib;
         bind # dig
         cac
         dic
-        ff
         file
         get
-        gitAndTools.qgit
         gnupg21
         haskellPackages.hledger
         htop
         jq
         manpages
         mkpasswd
-        mpv
         netcat
         nix-repl
         nmap
         nq
         p7zip
-        pavucontrol
         posix_man_pages
-        pssh
         push
         qrencode
-        sxiv
         texLive
         tmux
-        zathura
 
         #ack
         #apache-httpd
@@ -145,6 +119,8 @@ with lib;
         #xkill
         #xl2tpd
         #xsel
+
+        unison
       ];
     }
     {
@@ -180,132 +156,6 @@ with lib;
         ];
       };
     }
-    {
-      users.extraGroups = {
-        tv.gid = 1337;
-        slaves.gid = 3799582008; # genid slaves
-      };
-
-      users.extraUsers =
-        mapAttrs (name: user@{ extraGroups ? [], ... }: user // {
-          inherit name;
-          home = "/home/${name}";
-          createHome = true;
-          useDefaultShell = true;
-          group = "tv";
-          extraGroups = ["slaves"] ++ extraGroups;
-        }) {
-          ff = {
-            uid = 13378001;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          cr = {
-            uid = 13378002;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          fa = {
-            uid = 2300001;
-          };
-
-          rl = {
-            uid = 2300002;
-          };
-
-          tief = {
-            uid = 2300702;
-          };
-
-          btc-bitcoind = {
-            uid = 2301001;
-          };
-
-          btc-electrum = {
-            uid = 2301002;
-          };
-
-          ltc-litecoind = {
-            uid = 2301101;
-          };
-
-          eth = {
-            uid = 2302001;
-          };
-
-          emse-hsdb = {
-            uid = 4200101;
-          };
-
-          wine = {
-            uid = 13370400;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          df = {
-            uid = 13370401;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          xr = {
-            uid = 13370061;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          "23" = {
-            uid = 13370023;
-          };
-
-          electrum = {
-            uid = 13370102;
-          };
-
-          skype = {
-            uid = 6660001;
-            extraGroups = [
-              "audio"
-            ];
-          };
-
-          onion = {
-            uid = 6660010;
-          };
-
-          zalora = {
-            uid = 1000301;
-            extraGroups = [
-              "audio"
-              # TODO remove vboxusers when hardening is active
-              "vboxusers"
-              "video"
-            ];
-          };
-        };
-
-      security.sudo.extraConfig =
-        let
-          isSlave = u: elem "slaves" u.extraGroups;
-          masterOf = u: u.group;
-          slaves = filterAttrs (_: isSlave) config.users.extraUsers;
-          toSudoers = u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL";
-        in
-        concatMapStringsSep "\n" toSudoers (attrValues slaves);
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index e2cc2c06a..1a9dddb55 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -4,28 +4,12 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.xu;
-  krebs.build.user = config.krebs.users.tv;
 
-  krebs.build.target = "root@xu";
-
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/secrets/xu";
-    };
-    dir.stockholm = {
-      host = config.krebs.hosts.wu;
-      path = "/home/tv/stockholm";
-    };
-  };
+  krebs.build.source.git.nixpkgs.rev =
+    "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
 
   imports = [
     ../2configs/hw/x220.nix
-    ../2configs/base.nix
     #../2configs/consul-client.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
@@ -62,29 +46,23 @@ with lib;
         bind # dig
         #cac
         dic
-        ff
         file
-        gitAndTools.qgit  #xserver
         gnupg21
         haskellPackages.hledger
         htop
         jq
         manpages
         mkpasswd
-        mpv #xserver
         netcat
         nix-repl
         nmap
         nq
         p7zip
-        pavucontrol #xserver
+        pass
         posix_man_pages
-        #pssh
         qrencode
-        sxiv #xserver
         texLive
         tmux
-        zathura #xserver
 
         #ack
         #apache-httpd
@@ -142,6 +120,8 @@ with lib;
         #xkill
         #xl2tpd
         #xsel
+
+        unison
       ];
     }
     {
@@ -178,135 +158,6 @@ with lib;
         ];
       };
     }
-    {
-      users.extraGroups = {
-        tv.gid = 1337;
-        slaves.gid = 3799582008; # genid slaves
-      };
-
-      users.extraUsers =
-        mapAttrs (name: user@{ extraGroups ? [], ... }: user // {
-          inherit name;
-          home = "/home/${name}";
-          createHome = true;
-          useDefaultShell = true;
-          group = "tv";
-          extraGroups = ["slaves"] ++ extraGroups;
-        }) {
-          ff = {
-            uid = 13378001;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          cr = {
-            uid = 13378002;
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          fa = {
-            uid = 2300001;
-          };
-
-          rl = {
-            uid = 2300002;
-          };
-
-          tief = {
-            uid = 2300702;
-          };
-
-          btc-bitcoind = {
-            uid = 2301001;
-          };
-
-          btc-electrum = {
-            uid = 2301002;
-          };
-
-          ltc-litecoind = {
-            uid = 2301101;
-          };
-
-          eth = {
-            uid = 2302001;
-          };
-
-          emse-hsdb = {
-            uid = 4200101;
-          };
-
-          wine = {
-            uid = 13370400;
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          df = {
-            uid = 13370401;
-            extraGroups = [
-              "audio"
-              "video"
-              "bumblebee"
-            ];
-          };
-
-          xr = {
-            uid = 13370061;
-            extraGroups = [
-              "audio"
-              "video"
-            ];
-          };
-
-          "23" = {
-            uid = 13370023;
-          };
-
-          electrum = {
-            uid = 13370102;
-          };
-
-          skype = {
-            uid = 6660001;
-            extraGroups = [
-              "audio"
-            ];
-          };
-
-          onion = {
-            uid = 6660010;
-          };
-
-          zalora = {
-            uid = 1000301;
-            extraGroups = [
-              "audio"
-              # TODO remove vboxusers when hardening is active
-              "vboxusers"
-              "video"
-            ];
-          };
-        };
-
-      security.sudo.extraConfig =
-        let
-          isSlave = u: elem "slaves" u.extraGroups;
-          masterOf = u: u.group;
-          slaves = filterAttrs (_: isSlave) config.users.extraUsers;
-          toSudoers = u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL";
-        in
-        concatMapStringsSep "\n" toSudoers (attrValues slaves);
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/2configs/base.nix b/tv/2configs/default.nix
index 41159690d..6ed1c65f9 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/default.nix
@@ -1,14 +1,33 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
 with lib;
 
 {
   krebs.enable = true;
 
+  krebs.build = {
+    user = config.krebs.users.tv;
+    target = mkDefault "root@${config.krebs.build.host.name}";
+    source = {
+      git.nixpkgs = {
+        url = mkDefault https://github.com/NixOS/nixpkgs;
+        rev = mkDefault "c44a593aa43bba6a0708f6f36065a514a5110613";
+        target-path = mkDefault "/var/src/nixpkgs";
+      };
+      dir.secrets = {
+        path = mkDefault "/home/tv/secrets/${config.krebs.build.host.name}";
+      };
+      dir.stockholm = {
+        path = mkDefault "/home/tv/stockholm";
+        target-path = mkDefault "/var/src/stockholm";
+      };
+    };
+  };
+
   networking.hostName = config.krebs.build.host.name;
 
   imports = [
+    <secrets>
     ./vim.nix
     {
       # stockholm dependencies
@@ -17,36 +36,14 @@ with lib;
       ];
     }
     {
-      # TODO never put hashedPassword into the store
-      users.extraUsers =
-        mapAttrs (_: h: { hashedPassword = h; })
-                 (import <secrets/hashedPasswords.nix>);
-    }
-    {
-      users.defaultUserShell = "/run/current-system/sw/bin/bash";
-      users.mutableUsers = false;
-    }
-    {
-      users.extraUsers = {
-        root = {
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-          ];
-        };
-        tv = {
-          uid = 1337;
-          group = "users";
-          home = "/home/tv";
-          createHome = true;
-          useDefaultShell = true;
-          extraGroups = [
-            "audio"
-            "video"
-            "wheel"
-          ];
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-          ];
+      users = {
+        defaultUserShell = "/run/current-system/sw/bin/bash";
+        mutableUsers = false;
+        users = {
+          tv = {
+            isNormalUser = true;
+            uid = 1337;
+          };
         };
       };
     }
@@ -69,22 +66,8 @@ with lib;
       nix.useChroot = true;
     }
     {
-      # oldvim
-      environment.systemPackages = with pkgs; [
-        vim
-      ];
-
-      environment.etc."vim/vimrc".text = ''
-        set nocp
-      '';
-
-      environment.etc."vim/vim${majmin pkgs.vim.version}".source =
-          "${pkgs.vim}/share/vim/vim${majmin pkgs.vim.version}";
+      environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
 
-      environment.variables.EDITOR = mkForce "vim";
-      environment.variables.VIM = "/etc/vim";
-    }
-    {
       environment.systemPackages = with pkgs; [
         rxvt_unicode.terminfo
       ];
@@ -107,6 +90,15 @@ with lib;
         view = "vim -R";
       };
 
+      environment.variables = {
+        NIX_PATH =
+          with config.krebs.build.source; with dir; with git;
+          mkForce (concatStringsSep ":" [
+            "nixpkgs=${nixpkgs.target-path}"
+            "secrets=${stockholm.target-path}/null"
+          ]);
+      };
+
       programs.bash = {
         interactiveShellInit = ''
           HISTCONTROL='erasedups:ignorespace'
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 8c6c9fb45..04b1480c1 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -50,6 +50,8 @@ let
     set wildmenu
     set wildmode=longest,full
 
+    set et ts=2 sts=2 sw=2
+
     filetype plugin indent on
 
     set t_Co=256
@@ -64,9 +66,10 @@ let
 
     au BufRead,BufNewFile *.nix so ${pkgs.writeText "nix.vim" ''
       setf nix
+      set isk=@,48-57,_,192-255,-,'
 
       " Ref <nix/src/libexpr/lexer.l>
-      syn match INT   /[0-9]\+/
+      syn match INT   /\<[0-9]\+\>/
       syn match PATH  /[a-zA-Z0-9\.\_\-\+]*\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
       syn match HPATH /\~\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
       syn match SPATH /<[a-zA-Z0-9\.\_\-\+]\+\(\/[a-zA-Z0-9\.\_\-\+]\+\)*>/
@@ -77,8 +80,8 @@ let
       hi link SPATH Constant
       hi link URI Constant
 
-      syn match String /"\([^"]\|\\\"\)*"/
-      syn match Comment /\s#.*/
+      syn match String /"\([^\\"]\|\\.\)*"/
+      syn match Comment /\(^\|\s\)#.*/
     ''}
 
     au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 4d2fe9e45..afc2d699c 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -34,7 +34,14 @@ let
     };
 
     environment.systemPackages = [
+      pkgs.ff
+      pkgs.gitAndTools.qgit
+      pkgs.mpv
+      pkgs.pavucontrol
       pkgs.slock
+      pkgs.sxiv
+      pkgs.xsel
+      pkgs.zathura
     ];
 
     security.setuidPrograms = [
@@ -70,14 +77,6 @@ let
         ExecStart = "${xserver}/bin/xserver";
       };
     };
-
-    programs.bash.interactiveShellInit = ''
-      case ''${XMONAD_SPAWN_WORKSPACE-} in
-        za|zh|zj|zs)
-          exec sudo -u zalora -i
-        ;;
-      esac
-    '';
   };
 
   xmonad-environment = {
diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index 1ca5e70a2..2108d972c 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -1,6 +1,16 @@
 { pkgs, ... }:
 
 {
+  cr = pkgs.writeScriptBin "cr" ''
+    #! /bin/sh
+    set -efu
+    export LC_TIME=de_DE.utf8
+    exec ${pkgs.chromium}/bin/chromium \
+        --ssl-version-min=tls1 \
+        --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
+        --disk-cache-size=50000000 \
+        "%@"
+  '';
   ff = pkgs.callPackage ./ff {};
   viljetic-pages = pkgs.callPackage ./viljetic-pages {};
   xmonad-tv =